The vulnerability is a missing authorization flaw in the WordPress Booktics plugin. Incorrectly configured access control security levels allow an attacker to exploit unauthorized access to restricted functions and data within the plugin. This weakness is classified as CWE-862 and results in a CVSS score of 4.3, indicating moderate impact to confidentiality and integrity when the plugin's protected features are accessed.

Affected products are the Arraytics Booktics plugin for WordPress through version 1.0.27. Site owners using any of these versions and having the plugin installed are potentially exposed to unauthorized actions performed via the plugin's endpoints. The issue does not affect later releases, so version 1.0.28 and above contain the fix.

Risk assessment shows a moderate severity (CVSS 4.3) but the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting limited current exploitation activity. The likely attack vector is remote via crafted HTTP requests to the plugin's endpoints; this is inferred from the plugin's web-based nature. While no exploit code is documented, users with remote web access to the site should consider the vulnerability high risk if the plugin's sensitive functions expose critical data or control.